What are the assumption of it

[837951602]

JScrewIt turns "undefined" into "[][[]]" but undefined may be 3 while [][[]] may be 4

[fasttime]

JScrewIt assumes that predefined objects are not overwritten and that no changes are made to their prototype chains. So if we set Array.prototype[""] = 4 we are breaking that assumption.

undefined is more subtle: the global property "undefined" is not configurable and so it will always evaluate to void 0. We can shadow that value in a local scope, but then our input would no longer look like undefined, but something more complex like (undefined => undefined + 1)(3), and that evaluates to 4 as expected.

[837951602]

Yet [no changes on predefined objects' prototype] may be not so universal. Is it enough that predefined prototypes remain unchanged and [][[]] be undefined?

[fasttime]

@837951602 No, that's not enough. For example, if Function.prototype.toString is overwritten, a whole bunch of things stop working.

Note though that these restrictions only apply to the time the code is loaded, not to the time the code runs. It's perfectly ok to mess up with prototypes in your screwed code or in some other code that runs after your screwed code has been loaded.

[837951602]

@fasttime I meant that if a prototype is predefined(or to say, not undefined at the beginning), it's assumed to remain unchanged, thus Function.prototype.toString being destroyed doesn't fit

[fasttime]

@837951602 That's correct, but predefined objects like self, statusbar, String, etc. (and not just their prototypes) should also stay unchanged.

[837951602]

Note though that these restrictions only apply to the time the code is loaded, not to the time the code runs. It's perfectly ok to mess up with prototypes in your screwed code or in some other code that runs after your screwed code has been loaded.

!a()+!a() is turned into ![].filter.constructor('return a')()()+![].filter.constructor('return a')()() but if a() destroyed [].filter the 2nd !a() won't run

[fasttime]

@837951602 this is correct, and it's because of the order the expressions are evaluated. When this happens to be a problem it can be addressed using a code type generation other than "express". There is no option for this in the UI, but it can be done in JavaScript (maybe in the browser console).

JScrewIt.encode("!a()+!a()", { runAs: "eval" }); // eval("!a()+!a()")

or if the return value is not needed

JScrewIt.encode("!a()+!a()", { runAs: "call" });